October 12, 1995 The Honorable Thomas P. Grumbly Assistant Secretary of Environmental Management Department of Energy Washington, DC 20585 Dear Mr. Grumbly: A Defense Nuclear Facilities Safety Board staff review team visited the High-Level Liquid Waste Evaporator and the New Waste Calcining Facility (NWCF) at the Idaho Chemical Processing Plant on August 8-10, 1995, to review the electrical, instrumentation and control, and fire protection systems. The staff noted that, although the NWCF Distributed Control System is relied upon for safe shutdown of the facility, it is not subjected to the level of rigor in the design review, testing, and maintenance associated with such a system. The enclosed report is a synopsis of the observations made during the review and is forwarded for your consideration. Sincerely, John T. Conway Chairman c: The Honorable Tara O'Toole Mr. Mark Whitaker Enclosure DEFENSE NUCLEAR FACILITIES SAFETY BOARD August 29, 1995 MEMORANDUM FOR: G. W. Cunningham, Technical Director COPIES: Board Members FROM: R. T. Davis SUBJECT: Idaho National Engineering Laboratory - Idaho Chemical Processing Plant - Trip Report (August 8-10, 1995) 1. Purpose: This memorandum documents a review of electrical, instrumentation and control, and fire protection systems at the High-Level Liquid Waste Evaporator (HLLWE) and the New Waste Calcining Facility (NWCF) at the Idaho Chemical Processing Plant (ICPP). Electrical and fire protection issues from previous staff trips were also discussed. This review was performed by Defense Nuclear Facilities Safety Board (Board) staff members Ajit Gwal and Todd Davis on August 8-10, 1995. 2. Summary: The review identified the following major issues and observations: a. The NWCF procedures allow operation of the calciner during a loss of off-site power by using power from a diesel generator. During this situation, there is no backup power (i.e., power only from the diesel generator). Therefore, the possibility of a loss of all power is significantly increased. Because loss of normal and backup power is an abnormal condition that may challenge operators and the Distributed Control System (DCS), the staff believes that suspension of processing may be necessary during a loss of off-site power. b. The DCS plays an important role in safely operating the NWCF and HLLWE. The system is currently not identified as a safety system. Because of its importance, the DCS may warrant the increased rigor of design review, testing, and maintenance associated with safety related systems. For example, display of alarms and critical parameters, and operation of safety related interlocks rely on DCS operations and are not separately hard wired. c. NWCF personnel isolated the sprinkler system in the control room to prevent inadvertent actuation that would wet electrical equipment in the control room. However, the facility fire protection engineer was unaware of this modification. Lockheed Idaho Technologies Company (LITCO) will review this change and determine the correct configuration of the fire suppression system in the control room (a Halon system is also installed in the control room) and will also investigate why the change was not properly reviewed. d. Emergency exit doors were recently added to the facility. LITCO is reviewing the change to ensure that the effects on the ventilation system and contamination control were adequately reviewed. 3. Background: The NWCF replaced the previous calcining facility at Idaho National Engineering Laboratory and began operations in 1984. The facility converts liquid, high-level radioactive waste into a solid by calcination. The HLLWE is a front end process to the calciner that reduces the amount of liquid and increases the efficiency of the calciner. HLLWE construction was completed earlier this year and is scheduled to begin operation in May 1996. The NWCF is scheduled to be restarted in early 1997. 4. Discussion/Observations: a. Electrical Upgrade Project: LITCO is planning a 60 million dollar electrical upgrade project for the ICPP area. The project will replace overloaded and underrated equipment, correct design deficiencies, and increase system reliability. LITCO will complete this project in 2001. The project will eliminate some of the staff's concerns regarding equipment ratings. However, funding for the upgrade has not been approved. LITCO has prioritized the improvements and will request emergency funding for the most important upgrades if the project is not funded. b. Distributed Control System: The DCS provides process control of both the HLLWE and the NWCF. The main control room provides six graphic control stations for instrumentation display and system operation. The system uses a dual token-ring communication system and distributed programmable controllers with some distributed programming (so that part of the system may fail without affecting the whole system). Reliability measures maintained by LITCO indicate that the system is very reliable. The rapid shutdown system, which is part of the distributed control system, ensures the NWCF is placed in a safe shut-down condition during abnormal conditions (e.g., low calciner temperature or problems in the off-gas clean-up system). While the system provides important safety functions (e.g., display of critical parameters and safety related interlocks), the system and instrumentation are not classified as a safety significant system. This classification may reduce system reliability because of less stringent design review, maintenance, and testing as compared to a safety significant system. The system has a large number of alarms (greater than 1000). To aid in operator performance, the site has prioritized important alarms and will mask redundant or dependent alarms (e.g., pump failure because of a loss of power will alarm for loss of power but not for pump failure). This will enable operators to identify the fundamental problem and not be confused by a large number of simultaneous alarms. c. Control Room Fire Suppression System: Both a sprinkler and a Halon fire suppression system are installed in the control room. NWCF personnel isolated and drained the sprinkler system in the control room to prevent an inadvertent release of water on control room water sensitive equipment. The facility fire protection engineer was not aware of this modification. LITCO will review the control room fire suppression systems to ensure the control room is adequately protected and determine why the modification was not adequately reviewed. d. Emergency Exit Doors: Emergency exit doors were recently installed in the facility to meet National Fire Protection Association (NFPA) 101, Life Safety Code, requirements. However, the effect on the facility ventilation and contamination control system may not have been adequately considered. LITCO will review this modification to ensure the ventilation system and contamination control are not adversely affected. e. Operation Following Loss of Off-Site Power: The NWCF procedures allow operation of the calciner after loss of off-site power using power from the backup diesel generator. Calciner operation with no backup power (i.e., power only from the diesel generator) greatly increases the likelihood of losing all power to the DCS. Because this is an abnormal condition and may challenge operators and the DCS, the staff believes that it is prudent to suspend any processing during a loss of off-site power. f. Battery Ventilation: American National Standards Institute (ANSI) C2, National Electric Safety Code, requires adequate ventilation and loss of ventilation alarms for rooms with lead-acid batteries to ensure hydrogen does not buildup and result in an explosion. The battery ventilation system in the NWCF switchgear room does not meet the requirements of the National Electric Safety Code (i.e., inadequate ventilation and no loss of ventilation alarms). LITCO personnel stated that the system will be replaced soon and that the ventilation system will be upgraded during the replacement. g. Electrical Maintenance: LITCO personnel stated that relays used in the electrical distribution system are not periodically calibrated. This is contrary to industry standards and vendor recommendations. Inadequate calibration could prevent circuit breakers from operating during a fault condition and create unsafe conditions. h. Previous Staff Issues: Progress on the following two staff issues identified during previous trips to ICPP were discussed during the trip: 1. Propane Generator: Because of the hazard associated with the propane generator, which is located inside one of the fuel storage areas (CPP-603), LITCO will remove the generator by the end of 1995. 2. Emergency Power for Criticality Warblers: Several criticality warblers in CPP-603 facility are currently not supplied with emergency power. LITCO will deactivate warblers in facilities that no longer require criticality alarms. Additionally, the criticality alarm system in one facility of CPP-603 will be replaced with a new unit. Although several facilities still have warblers that are not supplied by emergency power, the criticality alarm signals will activate the site-wide alarm system that is supplied by emergency power. 5. Future Staff Actions: The staff will continue to follow the electrical upgrade project and resolution of the issues identified by this trip report. Prior to HLLWE and NWCF startup, additional review of the DCS to ensure the design and operation is consistent with the safety basis will be performed by the staff. The staff will also review the facility fire hazard analysis, pre-fire plan and NFPA 101 assessments, when available.